# Darkside Ransomware v1.8.6.2 - Reverse Engineering Analysis

> Technical reverse-engineering analysis of Darkside ransomware v1.8.6.2, a 32-bit Windows RaaS payload using hybrid RSA-1024/Salsa20 encryption with an aPLib-compressed config. It elevates via the ICMLuaUtil COM UAC bypass, deletes shadow copies, kills database, backup and productivity processes and services, and exits on Russian-language systems.

- **Published:** 2026-11-05T00:07:19Z
- **Last reviewed:** 2026-11-05T00:07:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5281
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5281.png
- **ID:** TL-2026-5281
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DarkSide
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (3 shown free below)

## Description

Darkside is a ransomware-as-a-service (RaaS) family whose affiliates encrypt and steal data from large, high-revenue organizations. This record documents the v1.8.6.2 32-bit Windows sample (MD5 9d418ecc0f3bf45029263b0944236884, SHA256 151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5) as reverse engineered by an independent researcher on 2021-05-06.

Configuration and obfuscation: the sample resolves its libraries and APIs dynamically from an encrypted name table, decrypts all strings with a XOR KEY_BUFFER derived from two hard-coded 16-byte keys, and wipes the resolved API array from memory after use. The embedded configuration holds the RSA-1024 exponent (0x0-0x7F) and modulus (0x80-0x103) followed by aPLib-compressed JSON-style flags, terminated with a 0xDEADBEEF marker. Flags observed: ENCRYPTION_MODE Full, UAC elevation enabled, shadow-copy deletion enabled, self-delete enabled, ransom note enabled, logging disabled. The configuration also carries the process and service kill lists, excluded file extensions and directories, the 32-byte victim ID and the C2 URLs.

Execution flow: the malware calls GetUserDefaultLangID and GetSystemDefaultUILanguage and exits immediately on Russian-language systems. It creates a mutex named Global\<CRC32 of the file contents>. It checks IsUserAnAdmin and token information; when unprivileged it bypasses UAC by calling CoGetObject with the moniker Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} (the ICMLuaUtil interface, backed by cmstplua.dll) and invoking ShellExec. It then enables privileges with AdjustTokenPrivileges and impersonates logged-on tokens. On 64-bit hosts it runs a hex-encoded PowerShell command, Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}; on 32-bit hosts it queries SELECT * FROM Win32_ShadowCopy through IWbemLocator/IWbemServices. It enumerates services with the Service Control Manager and stops or deletes those matching the kill list (vss, sql, svc$, memtas, mepocs, sophos, veeam, backup, GxVss, GxBlr, GxFWD, GxCVD, GxCIMgr), and terminates processes such as sql, oracle, ocssd, dbsnmp, agntsvc, excel, outlook, winword, powerpnt, msaccess, thunderbird and firefox, while sparing vmcompute.exe, vmms.exe, vmwp.exe, svchost.exe, TeamViewer.exe and explorer.exe.

Encryption: files are encrypted with Salsa20 using a random 64-byte matrix generated with RtlRandomEx; the matrix is encrypted with the custom RSA-1024 key and appended to each file as a 0x90-byte blob (0x80-byte encrypted matrix plus a 0x10-byte CRC32 block) that doubles as the already-encrypted marker. Traversal is a single-threaded depth-first walk feeding I/O-completion-port worker threads, which the analysis says causes thread starvation compared with Babuk or Conti. Many system extensions and directories are skipped (for example exe, dll, sys, lnk, windows, program files, programdata, tor browser). The recycle bin is enumerated, and network shares and hosts are discovered with NetShareEnum, GetAdaptersInfo, SendARP and gethostbyaddr. Command-line parameters: -path <directory> encrypts a directory, and a bare filename encrypts a single file. The ransom note is named README<GUID checksum>.TXT.

C2 and cleanup: on port 443 the sample POSTs victim details (username, hostname, domain, OS version, architecture, disk information) to securebestapp20.com and temisleyes.com using a Firefox/80.0 user agent, in the format random_num1=hash(info)&random_num2=victim_UID, and later reports encrypted file counts, bytes encrypted, skipped files and elapsed time. It then self-deletes with CMD.EXE /C DEL /F /Q <short path> >> NUL. The hunt data also lists the onion address darksidfqzcuhtk2.onion.

Broader context from public reporting: the CISA/FBI alert AA21-131A (2021-05-11) covered the DarkSide attack on Colonial Pipeline. Reporting describes affiliate initial access through brute-force attacks, spam campaigns, purchased credentials and vulnerable RDWeb/RDP/Citrix, post-exploitation with Cobalt Strike, Metasploit, Mimikatz and BloodHound, and living-off-the-land activity. The source article itself provides no CVEs, no CVSS score and no actor attribution.

## MITRE ATT&CK

- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1480 Execution Guardrails
- T1614.001 System Location Discovery: System Language Discovery
- T1135 Network Share Discovery
- T1018 Remote System Discovery
- T1057 Process Discovery
- T1007 System Service Discovery
- T1082 System Information Discovery
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Darkside Ransomware Shadow Copy Deletion via PowerShell/WMI Win32_Shadowcopy** (`TL-2026-5281-SPL-001`)

Detects PowerShell, pwsh or wmic invoking Win32_Shadowcopy with a Delete/Remove-WmiObject action, the exact command Darkside v1.8.6.2 runs (hex-encoded in the binary) on 64-bit hosts to destroy Volume Shadow Copies before encryption. Behaviour-first: fires on the WMI shadow-copy deletion regardless of sample hash or C2 domain.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1059.001, T1047
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wmic.exe") CommandLine="*Win32_Shadowcopy*" (CommandLine="*Delete*" OR CommandLine="*Remove-WmiObject*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentImage) as parent_image by host User Image
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S"), detection="TL-2026-5281 Darkside Win32_Shadowcopy deletion"
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wmic.exe")
| where ProcessCommandLine has "Win32_Shadowcopy" and ProcessCommandLine has_any ("Delete", "Remove-WmiObject")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Darkside Ransomware Shadow Copy Deletion via Win32_Shadowcopy
id: 5b1f2c6e-3a47-4d0e-9c1a-7e2d8f4b6a01
status: experimental
description: Detects PowerShell or WMIC deleting Volume Shadow Copies through the Win32_Shadowcopy WMI class, as done by Darkside v1.8.6.2 on 64-bit hosts
references:
    - https://www.chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-131a
    - https://intel.threadlinqs.com/threats/TL-2026-5281
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.impact
    - attack.t1490
    - attack.execution
    - attack.t1059.001
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wmic.exe'
    selection_class:
        CommandLine|contains: 'Win32_Shadowcopy'
    selection_action:
        CommandLine|contains:
            - 'Delete'
            - 'Remove-WmiObject'
    condition: all of selection_*
falsepositives:
    - Backup or storage administration scripts that prune shadow copies
    - Disk-cleanup tooling run by IT
level: high

```

**Known false positives:**

- Backup/storage admin scripts that prune old shadow copies via WMI
- Disk-cleanup or imaging tools run by IT staff

**Tuning notes:** Allow-list known backup-admin hosts/accounts and signed maintenance scripts. If PowerShell is launched with -EncodedCommand (the sample stores the command hex-encoded), pair with Script Block Logging (EventCode 4104) searching for Win32_Shadowcopy. Raise to auto-containment when the parent is an unsigned binary in a user-writable path.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Darkside Mass Stop of Backup, VSS, SQL and Security Services (locked: unlock with TL Creds)
- Darkside Ransom Note README<hex>.TXT Created Across Many Directories (locked: unlock with TL Creds)
- Darkside Affiliate Tooling: Mimikatz and BloodHound/SharpHound Execution (locked: unlock with TL Creds)
- Darkside Self-Deletion via cmd.exe /C DEL /F /Q >> NUL (locked: unlock with TL Creds)
- Darkside Termination of Database, Backup and Office Processes (locked: unlock with TL Creds)
- Cobalt Strike Default Named Pipes Used by DarkSide Affiliates (locked: unlock with TL Creds)
- Darkside ICMLuaUtil (CMSTPLUA) COM Elevation UAC Bypass (locked: unlock with TL Creds)
- Darkside C2 Domains, Onion Address and Community-Observed Sibling Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 15)

Defanged, TLP:CLEAR.

- Domain: `securebestapp20[.]com`
- File hash: `9d418ecc0f3bf45029263b0944236884`
- Domain: `temisleyes[.]com`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Darkside Ransomware (v1.8.6.2 reverse engineering)](https://www.chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/)
- [CISA/FBI Alert AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-131a)
- [US CISA and FBI publish joint alert on DarkSide ransomware](https://securityaffairs.com/117835/malware/darkside-cisa-fbi-alert.html)
- [Cyber Threat Advisory: DarkSide Ransomware Attack on Colonial Pipeline](https://www.infoblox.com/blog/cyber-threat-intelligence/cyber-threat-advisory-darkside-ransomware-attack-on-colonial-pipeline/)
- [The DarkSide of the Ransomware Pipeline](https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.html)
- [What We Know About DarkSide Ransomware and the US Pipeline Attack (Trend Micro)](https://www.trendmicro.com/en_us/research/21/e/what-we-know-about-darkside-ransomware-and-the-us-pipeline-attac.html)
- [DOJ recovers $2.3 mln of Colonial Pipeline's ransom](https://news.yahoo.com/doj-recovers-2-3-mln-232738803.html)
- [BlackMatter ransomware gang is shutting down due to pressure from law enforcement](https://securityaffairs.com/124135/cyber-crime/blackmatter-ransomware-shutting-down-operations.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5281